Skip to content

Commit

Permalink
tetragon: Add generic multi kprobe override support
Browse files Browse the repository at this point in the history
Signed-off-by: Jiri Olsa <[email protected]>
  • Loading branch information
olsajiri committed Jul 12, 2023
1 parent 4490320 commit dd1c9e7
Showing 1 changed file with 10 additions and 3 deletions.
13 changes: 10 additions & 3 deletions pkg/sensors/tracing/generickprobe.go
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,9 @@ type genericKprobe struct {

// policyName is the name of the policy that this tracepoint belongs to
policyName string

// is there override defined for the kprobe
hasOverride bool
}

// pendingEvent is an event waiting to be merged with another event.
Expand Down Expand Up @@ -498,8 +501,6 @@ func createGenericKprobeSensor(
}
}

hasOverride := selectors.HasOverride(f)

// Write attributes into BTF ptr for use with load
if !setRetprobe {
setRetprobe = f.Return
Expand Down Expand Up @@ -530,6 +531,7 @@ func createGenericKprobeSensor(
pendingEvents: nil,
tableId: idtable.UninitializedEntryID,
policyName: policyName,
hasOverride: selectors.HasOverride(f),
}

// Parse Filters into kernel filter logic
Expand Down Expand Up @@ -570,7 +572,7 @@ func createGenericKprobeSensor(
pinProg,
"generic_kprobe").
SetLoaderData(kprobeEntry.tableId)
load.Override = hasOverride
load.Override = kprobeEntry.hasOverride
progs = append(progs, load)

fdinstall := program.MapBuilderPin("fdinstall_map", sensors.PathJoin(sensorPath, "fdinstall_map"), load)
Expand Down Expand Up @@ -755,8 +757,13 @@ func loadMultiKprobeSensor(ids []idtable.EntryID, bpfDir, mapDir string, load *p

data.Symbols = append(data.Symbols, gk.funcName)
data.Cookies = append(data.Cookies, uint64(index))

if gk.hasOverride {
data.Overrides = append(data.Overrides, gk.funcName)
}
}

load.Override = len(data.Overrides) > 0
load.SetAttachData(data)

if err := program.LoadMultiKprobeProgram(bpfDir, mapDir, load, verbose); err == nil {
Expand Down

0 comments on commit dd1c9e7

Please sign in to comment.